Since 2007, “the Cloud” has been treated in boardrooms as a buzz word for any online service that doesn’t operate in-house. Cloud services are not a new concept, as they’ve been one of the defining features of the Internet from early on, but the types of services offered has grown considerably. FTP, email, and data sharing have exploded into being able to completely host a business infrastructure off-site.
With the massive availability of sometimes ridiculously specialized services, it’s easy for companies to get lulled into believing that moving their business to “the cloud” is the cheapest and easiest option. Who wouldn’t want to minimize their effort and maximize their profits by pushing the boring or complex work offsite?
All good things come at a price, though. In order to make that leap, companies have got to understand that utilizing business cloud services isn’t a lateral pass-off. Considerable time and money sometimes must be invested in keeping those service both useful and secure. Before that trigger is pulled, companies need to consider what they’re gaining by converting to (subscribed) virtual/remote services versus what they’re losing by diminishing their in-house (fully owned) resources.
So easy, what’s the catch?
Loss of company-specific non-IT expertise: Moving and operating a business in the cloud is not the exclusive realm of the IT department. Every company has a set of applications, processes, and data flow models that define how they do business. When you shift to a cloud-based model, many of the people who supported those systems might seem to be needed anymore. Sure, you can buy extra support from the cloud service, but that is typically focused on keeping the service itself up and running – not in understanding your data flow. Every business is a unique experience, and even the most mundane tasks are modified for specific company environments. Some proprietary or industry-specific applications have quirks that only the people working with them full time will learn and manage according to the individual company. There is simply no way to replicate this kind of organic flexibility when moving into the cloud.
Learning “how to cloud”: No matter how broad or specialized a cloud service might be, there’s going to be a learning curve for your staff to use them effectively. That means either pivoting existing staff to integrate the new and different sets of skills or else replacing them with staff that might not have quite as much “newness” to learn. Shifting existing personnel into new roles isn’t impossible, but anytime there is a drastic change in technology, there is a lag time between learning and becoming an expert. That lag is still present when replacing personnel but instead in terms of losing employees who were already a part of the culture and character of the company.
Cost of moving data: The internet does not run for free, and when a company moves to a cloud-based service, their existing data has to move into that service. Frequently, there are costs for moving data up to the cloud and back down. They might not seem too significant at first as they might be a fraction of a penny per megabyte of data transferred, but when you need to move data from an internal process up to the cloud for processing and then back down for reporting or other processes it can start to add up quickly.
Lose of control: Moving data to the cloud inherently means losing control of it. Sure, every cloud service claims that the data is still 100% under your control. What happens if they close shop, or if they get bought out, or if they suffer massive data loss from accidental or deliberate disaster? Whoever has control of the physical servers has absolute control over the data on them, regardless of any safeguards or on-paper guarantees. Even if every single bit is encrypted, the company running the servers has physical access to the data. If a company is less than scrupulous, or if a third party decides to infiltrate, they could spend time brute forcing that decryption, or they can just monitor the traffic to the server and capture the keys.
This also brings up the question of data deletion, one of the lesser-mentioned vital parts of data control and security. When you own the servers, you can take the old hard drive or storage media and destroy it however you see fit. If you’re removing business-specific data from a cloud service, you have no idea how many backups have been kept or for how long. And when you end a relationship with a cloud service, it is nearly impossible to get any sort of guarantee that your data is permanently destroyed.
Harder to secure: There are many articles of companies losing data due to having mis-configured cloud services. Usually, these are databases that are left naked to the internet. While the general consensus is that it’s mainly user-based activity that creates the lack of security, many cloud providers are also still behind the curve on security. Newly created users or companies are usually allowed to have full access instead of being trained more directly on creating a secure environment or just being locked down from the start. Ultimately, though, while there is a shared responsibility between users and providers in configuring that secure environment, companies will always be at least one step behind wherever the cloud provider is in terms of data protection.
Cloud services are not all leaks and puddles
Obviously, there are countless positive reasons for companies to utilize cloud services. SaaS (Software as a Service) and IaaS (Infrastructure as a Service) give smaller businesses access to the same types of heavy-hitter resources that large corporations do, not to mention avoiding the sometimes significant costs of creating information infrastructures. And, yes, there is always going to be a risk, but moving services and data into the cloud doesn’t have to be a difficult task.
First, know that not all cloud services are created equal – and that the biggest is not necessarily the best. Second, determine conservatively what services your company truly needs to implement off premises. Do you only need massive storage options, or do you need access to full suites of applications? Is your company served best with a proprietary solution (often with a higher subscription premium) or will a general-purpose operation do the job?
Research the services you feel your company is going to benefit from the most, and then share these idea with both IT and non-IT staff. Your company is more than just data and numbers: do as much as you can to ensure your cloud experience is truly a secure and positive change.